vendor: update buildkit to v0.31.0-rc2

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/envelope.go

@@ -1,8 +1,10 @@
 package dsse
 
 import (
+	"bytes"
 	"encoding/base64"
 	"fmt"
+	"strconv"
 )
 
 /*
@@ -42,9 +44,27 @@ PAE implements the DSSE Pre-Authentic Encoding
 https://github.com/secure-systems-lab/dsse/blob/master/protocol.md#signature-definition
 */
 func PAE(payloadType string, payload []byte) []byte {
-	return []byte(fmt.Sprintf("DSSEv1 %d %s %d %s",
-		len(payloadType), payloadType,
-		len(payload), payload))
+	// Pre-size to avoid reallocation. Previously fmt.Sprintf copied payload
+	// into a string and []byte(...) copied it again.
+	const prefix = "DSSEv1 "
+	const sep = " "
+	// Max decimal digits for a non-negative int (len() result) on any
+	// platform: len("9223372036854775807") == 19. Grow is a hint, so a
+	// slight overestimate is harmless.
+	const maxDecimalLen = 19
+	var b bytes.Buffer
+	b.Grow(len(prefix) +
+		maxDecimalLen + len(sep) + len(payloadType) + len(sep) +
+		maxDecimalLen + len(sep) + len(payload))
+	b.WriteString(prefix)
+	b.WriteString(strconv.Itoa(len(payloadType)))
+	b.WriteByte(' ')
+	b.WriteString(payloadType)
+	b.WriteByte(' ')
+	b.WriteString(strconv.Itoa(len(payload)))
+	b.WriteByte(' ')
+	b.Write(payload)
+	return b.Bytes()
 }
 
 /*

vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go

@@ -24,18 +24,26 @@ type AcceptedKey struct {
 }
 
 func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]AcceptedKey, error) {
+	keys, _, err := ev.VerifyAndDecode(ctx, e)
+	return keys, err
+}
+
+// VerifyAndDecode behaves identically to Verify but also returns the decoded
+// envelope payload, allowing callers who need the payload bytes (e.g., for
+// hashing or further parsing) to avoid a second base64 decode.
+func (ev *EnvelopeVerifier) VerifyAndDecode(ctx context.Context, e *Envelope) ([]AcceptedKey, []byte, error) {
 	if e == nil {
-		return nil, errors.New("cannot verify a nil envelope")
+		return nil, nil, errors.New("cannot verify a nil envelope")
 	}
 
 	if len(e.Signatures) == 0 {
-		return nil, ErrNoSignature
+		return nil, nil, ErrNoSignature
 	}
 
 	// Decode payload (i.e serialized body)
 	body, err := e.DecodeB64Payload()
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	// Generate PAE(payloadtype, serialized body)
 	paeEnc := PAE(e.PayloadType, body)
@@ -48,7 +56,7 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 	for _, s := range e.Signatures {
 		sig, err := b64Decode(s.Sig)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		// Loop over the providers.
@@ -97,14 +105,14 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 
 	// Sanity if with some reflect magic this happens.
 	if ev.threshold <= 0 || ev.threshold > len(ev.providers) {
-		return nil, errors.New("invalid threshold")
+		return nil, nil, errors.New("invalid threshold")
 	}
 
 	if len(usedKeyids) < ev.threshold {
-		return acceptedKeys, fmt.Errorf("accepted signatures do not match threshold, Found: %d, Expected %d", len(acceptedKeys), ev.threshold)
+		return acceptedKeys, nil, fmt.Errorf("accepted signatures do not match threshold, Found: %d, Expected %d", len(acceptedKeys), ev.threshold)
 	}
 
-	return acceptedKeys, nil
+	return acceptedKeys, body, nil
 }
 
 func NewEnvelopeVerifier(v ...Verifier) (*EnvelopeVerifier, error) {